What Is Open Redirect?

Why It Matters

Open redirects are listed in the OWASP Top 10 as a known security vulnerability. They let attackers abuse your domain’s reputation to make phishing links look trustworthy.

The server responds with a 3xx status code and a Location header pointing to whatever URL the attacker supplied. For domain forwarding, this is relevant because it’s the opposite of what a redirect service should do. A properly configured domain forwarding service has fixed destinations — you set where the domain goes, and that’s that. There’s no URL parameter for attackers to manipulate.

How It Works

A vulnerable application accepts a redirect destination from the URL:

https://bank.com/login?redirect=https://evil-phishing-site.com

The server redirects to whatever URL is in the parameter — no validation. Attackers use this to:

1. Send phishing emails with links that start with https://bank.com/...
2. Victims see the trusted domain and click
3. They land on the attacker’s fake login page
4. Credentials are stolen

Why Domain Forward Is Not an Open Redirect

Domain Forward forwarding rules are:

• Owner-configured — only the domain owner sets the destination in the dashboard
• Fixed per domain — old-domain.com always goes to the same destination
• No URL parameters — there’s no ?url= or ?redirect= parameter to exploit
• Authenticated — changing the destination requires logging into your account

This is fundamentally different from an “open redirect” vulnerability, where any user can control the destination through a URL parameter.